moved deleting user to before deleting token as otherwise it had no token so failed